Website contains some hidden scripts, unable to finding the location.

I just build a product which is based on web mail system is actually a Roundcube Skins or Themes for Email Sharing purposes. I personally need some advice or suggestion. Actually I Scan my website on free website malware and security scanner. The Tool has found a hidden and suspicious javascript (or iframe) . So, i have tried to remove it manually by finding it on back end but didn't got the scripts which contains the unnatural content. What should i do to make it malware free.